TY  - JOUR
A1  - Dick, Uwe
A1  - Scheffer, Tobias
T1  - Learning to control a structured-prediction decoder for detection of HTTP-layer DDoS attackers
T2  - Machine learning
N2  - We focus on the problem of detecting clients that attempt to exhaust server resources by flooding a service with protocol-compliant HTTP requests. Attacks are usually coordinated by an entity that controls many clients. Modeling the application as a structured-prediction problem allows the prediction model to jointly classify a multitude of clients based on their cohesion of otherwise inconspicuous features. Since the resulting output space is too vast to search exhaustively, we employ greedy search and techniques in which a parametric controller guides the search. We apply a known method that sequentially learns the controller and the structured-prediction model. We then derive an online policy-gradient method that finds the parameters of the controller and of the structured-prediction model in a joint optimization problem; we obtain a convergence guarantee for the latter method. We evaluate and compare the various methods based on a large collection of traffic data of a web-hosting service.
Y1  - 2016
UR  - https://publishup.uni-potsdam.de/frontdoor/index/index/docId/45013
SN  - 0885-6125
SN  - 1573-0565
VL  - 104
SP  - 385
EP  - 410
PB  - Springer
CY  - Dordrecht
ER  -